Canopy is hierarchical identity and access management for B2B SaaS: full authentication, enterprise SSO and directory sync, and roles that inherit down your customers' org tree. Infrastructure you rely on, not code you maintain.
Every B2B SaaS app eventually has to answer one question. The industry's standard answer breaks the moment a customer has structure.
Sooner or later, every B2B app must answer: “Can this user do this action, in this part of the organization?” The standard answer is flat role-based access control: a user gets a role, the role has permissions. It works until a customer has regions, offices, departments, franchises, or teams. Then a flat list of roles can't express who can do what, where, and teams end up building a custom hierarchy-and-permissions system from scratch.
Flat role-based access control is the industry standard, and it stops at a flat list. A role applies everywhere or nowhere, so it can't say a regional manager has access across their region but not others. That missing layer, permissions that inherit down an org tree, is what teams end up building from scratch, then securing and maintaining forever.
Canopy provides the full authentication lifecycle, enterprise SSO (SAML + OIDC) and SCIM directory sync, and the differentiator: hierarchical RBAC. Assign a role at any node in the tree and its permissions inherit downward automatically. It starts as flat RBAC and grows into hierarchy with no migration: the same roles, now scoped to structure.
Access control that reflects how organizations are actually structured should be something you depend on, not something each company writes, secures, and maintains on its own.
Authentication, enterprise SSO and directory sync, and the hierarchical authorization teams usually build by hand, together in one place.
| Capability | Included |
|---|---|
| Authentication & session management | |
| Enterprise SSO: SAML & OIDC | |
| SCIM directory sync | |
| Role-based access control | |
| Hierarchical RBAC with inheritance | Defines Canopy |
Hierarchical permission inheritance (a role assigned at any node in your org tree cascades to everything beneath it) is the capability that defines Canopy.
Not slogans. These map directly to decisions in the product.
Access control belongs in a system you depend on, not boilerplate every company writes, secures, and maintains itself.
Modern password hashing, MFA, SSO and SCIM, full audit logging, and environment-isolated secrets: on by default, not bolted on.
Hierarchy and inheritance, not flat lists, because regions, departments, and teams are how companies are actually shaped.
An API developers integrate in hours, plus an Admin Workspace non-engineers can actually use to manage access.
Strict Account → Application → Environment boundaries, so a change in development can never reach into production.
Start with simple roles and grow into a full org tree when you need it. The same roles carry forward. Your code doesn't change.
Canopy isn't a thin RBAC layer. It's the full identity stack, with tenant isolation built into the architecture, not added later.
Real authentication rigor, applied everywhere, not a checklist for later.
Every tenant is sealed by a strict three-tier boundary.
A change in one environment can never touch another.
Whether you're evaluating, buying, or just curious, here's how to reach us.
SSO, SCIM, custom limits, security review, or a guided evaluation.
Press, partnerships, or anything that doesn't fit a box. Say hello.
Read the docs, browse the API, and start building in minutes.